How do COVID-19 tracing apps work and what kind of data do they use?

Detecting and isolating COVID-19 cases is a priority to slow down the spread of the pandemic. Specifically, the WHO has reiterated  that, besides finding, testing, isolating, and treating every positive case of COVID-19, it is vital to "trace all contacts" of individual positives with other people in order to curtail virus spread rates. Mobile technology offers a powerful tool to facilitate this task through 'apps' that collect user data. The cases of countries such as South Korea have clearly illustrated how effective they can be at the time of identifying and notifying citizens that may come into contact with infected individuals. However, in Europe, for the time being, and partly due to strict privacy regulations, models use more limited data.

How do these applications really work?, ere they breaching users’ privacy in any way?, and how effective are they really to control the coronavirus pandemic? To answer these and other questions, we contacted Juan Murillo, a member of the Data Strategy team at BBVA and an expert in the use of 'big data' for the greater good.

How do these 'apps' work?

To understand how these applications work, the first thing that should be kept in mind is that not all of them work in the same way. In general, the 'apps' rolled out to date in Spain and in other western countries focus on self-diagnosing the disease, symptom monitoring and notifying cases to health authorities.

For example, AsistenciaCovid19, which launched first as a pilot in the Community of Madrid and has now been rolled out by other autonomous communities in Spain, features a questionnaire based on which users can check whether the symptoms they may be experiencing are compatible with typical COVID-19 symptoms. Based on this information, the 'app' provides recommendations regarding the need to isolate or contact health services. It also allows users to track how their symptoms evolve.

Optionally, users can also accept to share their device’s location data with the app, "with the purpose of guaranteeing the quality of the data and its epidemiological analysis," as they explain on the app’s website. What the app does require users to do is to fill out a form with personal info, including a contact address where health authorities can reach the person if necessary. This 'app' has some similarities with Stop Covid19 Cat, offered in Catalonia. However, the latter requires users to consent to share their geolocation data, which allows authorities to gather information on how the pandemic is spreading throughout the region.

“These applications are chiefly intended to help prevent COVID support hotlines from collapsing and collecting certain socio-demographic data, such as user gender and age. And, while at it, they can also gather geolocation data from users’ devices, although, in principle, all this data is anonymized and aggregated,” says Murillo.

Differences in Eastern and Western countries

This is one of the key differences between the 'apps' that launched in, for instance, Spain to date, and the ones rolled out in Asian countries such as China, South Korea or Japan. While solutions launched in western countries, currently exclusively collect, mainly, anonymous and aggregated data (that is, in such a way that the individual to whom the data refers cannot be identified), the applications created in some eastern nations collect more personal - and identifiable - data based on which authorities are able to implement more active measures to keep the disease from spreading.

"There are cultural factors that set apart the choices that individuals in the East and West might make"

“In short, the more sensitive the data is from a privacy protection standpoint, the more useful it is from an epidemiological point of view. This implies that citizens may be faced with having to choose between anonymity and convenience, which is something we all have to do in any case on a daily basis when using digital services,” he adds. Still, there are cultural factors that set apart the choices that individuals in the East and West might make: faced with this dilemma, in the East, the common good prevails over individual rights,” he adds.

In the case of South Korea, in early March, the government launched 'Self-quarantine safety protection', an ‘app’ that collects information on the user's health, location and places they’ve visited, based on the device’s GPS tracking information. With these data, the application is capable of notifying authorities whether an individual ordered to self-quarantine sneaks out, or of alerting other citizens when they are found to have been in contact with a positive case. The application also collects data such as user gender and nationality.

Similar applications have been launched in Japan or Singapore, where a Bluetooth-enabled system notifies users whether they have been in contact with an infected person. “South Korea, or Japan, are actively collecting data at an individual level, although their apps allow users the possibility of opting out.However, a huge majority of citizens are explicitly consenting to the use of their data because they understand that, just as with fires, it is critical to identify COVID-19 hotspots early to isolate them and keep them from spreading, and consider that their governments are going to use whatever data they collect responsibility from a security and privacy standpoint,” explains Murillo.

The privacy debate

On the other side of the spectrum, the approach followed in countries such as China, which have made these applications mandatory, has sparked a debate on the limits of user privacy. “Solutions differ from country to country and depend a lot on their level of democratization and individual rights protection. In Europe, where data protection is a fundamental right, measures tend to be much more scrupulous when it comes to privacy, and always seek voluntary consent when dealing with potentially intrusive situations,” recently said Ana Segovia, from the BBVA Digital Regulation team.

In the case of South Korea or Singapore, the use of more sensitive data by their apps, controversial as it may be, also offers a series of advantages from an epidemiological point of view. “Working based on personal information enables making much more accurate diagnosis based on highly relevant epidemiological metrics, such as the number of people infected by each new COVID-19 case relative to the number of people with whom he/she’s been in contact while he/she was a potential transmitter of the disease. It also allows keeping track of anyone who might’ve traveled on the same means of public transport with a potential transmitter,” explains Murillo.

According to a study published in Science magazine in late March, the use of a contact tracing app that builds a memory of proximity contacts of positive cases “can achieve epidemic control if used by enough people.”

In comparison, the solutions that use anonymized and aggregated data, like the ones being rolled out in Europe, are "less powerful" – in the sense that they are not capable of offering individualized information. Which doesn’t mean they’re not useful. “For example, they can help measure the effectiveness of different measures to keep COVID-19 from spreading, for example, by correlating the decrease in mobility metrics with the flattening of the contagion curve,” he adds.

Other private initiatives

For the time being, however, the penetration (number of downloads in relation to the total population) of this type of application in Spain has been relatively low compared to what has happened in the East. As reported by El País newspaper, for example, the app launched by the Autonomous Community of Madrid has amassed a meager 50,000 downloads, compared to a population of six and a half million people.

Faced with this situation, governments have carried out some collaboration projects with different private data service providers (such as telecommunications companies), to be allowed to tap, for example, into their anonymous and aggregated mobility datasets, based on the smartphone geolocation information they capture. “This situation creates a certain level of discordance regarding the standards and quality of data, which requires countries’ to request assistance from both their respective national statistical institutes and epidemiology experts to ascertain the degree of usability of these heterogeneous sources,” explains the expert.

"The solutions vary among countries and greatly depend on their level of democratization and the protection of individual rights"

For their part, Google and Apple recently announced a partnership agreement to facilitate the installation of COVID-19 tracking applications developed by governments via Android and Apple operating systems on mobile devices. The idea would be to make it easier for these 'apps' to be automatically downloaded as part of smartphone system updates. “Given the low penetration of government-sponsored 'apps', this approach would ensure access to a substantial share of the population,” explains Murillo. Google and Apple’s mobile operating systems power more than 99% of the world’s smartphones.

And how would they use the data? According to company sources, their servers will store encrypted and pseudo-anonymous information captured from users’ devices, "assigning an ID tag to each user which, in principle, would make it very hard to identify them as individuals," adds Murillo. Regarding consent to the use of data, the application would need to comply with the regulations in force in each country where it is deployed. With respect to whether the use will be obligatory or not, both companies have announced that they will not enforce the mandatory use of apps using this functionality.

Next steps in Spain

So, will applications similar to those being used in Asian countries ever be rolled out in Europe? On the one hand, in mid-April, the Secretary of State for Artificial Intelligence of the Government of Spain announced its participation in PEPP-PT, the Pan-European Proximity Tracking to Preserve Privacy project, which aims to facilitate the adoption of a “EU-wide proximity tracking app". Notwithstanding, the key players have not yet reached consensus about which technical solution to use for the collection and centralized processing of data, “and most likely decentralized alternatives will be evaluated,” Murillo explains.

The goal of this project is to develop a solution similar to the ones used in countries like South Korea, capable of notifying users of close contacts with COVID-19 carriers. To do this, the application would allow users to disclose whether they have the disease and, based on that information, warn other users with a Bluetooth notification if they come in contact with an infected person since they installed the application.

The 'app' will be automatically delivered to users' devices via operating system updates thanks to the new protocol created by Google and Facebook. Governments would be responsible for developing their specific apps themselves. However, the companies have announced that the APIs enabling interoperability between their operating systems and the applications developed by the authorities won’t be ready until May.

“These technological solutions and the data they gather, together with containment measures and widespread and recurrent testing, will be essential elements in helping us overcome this crisis,” concludes the expert.